We have a Small-medium-sized  client who has flat network ( VLAN 1) for everything (Phones, Servers and PCs) And they have remote sites which uses VPN to connect to their HQ. They want to use different VLANs for Phones, DATA and Servers. So they got two cisco SG550X as core switches as shown in the diagram below .. I've got few questions about the design below if someone could help : 1) First regarding VRRP: I will configure it for VLAN 1,2 and 3,  Can I do it for VLAN 16 & 17 ( connecting to FWs)? or it's not recommended? 2) Do I need to connect the core switches (SW-Core1-550 & SW-CORE2-550 ) together (uplink)? 3) As you can see in the diagram, the two core switches are connected to one access switch (1gig switch), is it better to split the connection into two access switch instead of one?  4) Is it better to connect Netgear switch (10gig switch) to the two core switches instead of the (1gig) HPE access switch?   5) As in the old design they have only default VLAN1, now with new design we need to create all VLANs in all access switches and configure all uplinks between switches as trunk...is that right? 6)As you can see the AVAYA IP Office manager (Server)  is in different subnet (192.168.50.9) than phone VLAN (192.168.2.0/24) Will the phone devices be able to reach the call manger to register? Note:  IP routing is enabled on the core switches. -DHCP Relay/IP helper is enabled on the core switches. -Windows server( 192.168.50.2)  is used as DHCP Server.(created 3 DHCP Scopes for the 3 VLANs with required option for AVAYA) ... View more

Hi there,   We have Site-to-Site IPSec VPN between two sites using two ASAs firewalls, one site has two links connections to two different ISPs (primary and backup) and it used to work fine until this site (with 2 wan connections) has changed the IP address of their primary link to different broadband provider. So, I changed the outside interface to the new one, and updated the default-gateway to the new broadband provider and for the other branch I modified the connection profile to use the new IP address for the remote peer (VPN did fail over to backup while switching to new primary but again didn't work). Unfortunately didn't work, so I deleted the connection profiles and start from the scratch and the tunnel is up and I can see traffic encrypted and decrypted on both side the tunnel. However, I can't reach the LAN subnets from both side (e.g.: ping isn't working) I checked the NAT and ACLs, but I couldn't find anything wrong. What's the best method to troubleshoot this case? I tried to use packet tracer for icmp traffic but I find it very confusing which destination address to use (e.g: LAN1 : 192.168.1.10/24 & LAN2: 172.16.1.10/24) (I used ASDM to create site-to-site IPSec VPN on both side, could it a bug in ASDM? Should I use CLI to create the tunnel instead?) Do I need to reload the ASA for the changes to take effect?   ASA1 :  ASA5515, 8192 MB RAM, Version 9.9(2) ASA2:   ASA5525, 8192 MB RAM, Version 9.6(3)1 ... View more